CVE-2021-4028

What it actually does

Use-after-free in Linux kernel RDMA CM listener code allows a local attacker to create a listening socket on a high port that leaves a list element dangling after free, enabling memory corruption that can crash the kernel or escalate privileges.

Why it matters to the business

Local attackers on affected Linux systems can crash servers or gain elevated access, causing downtime, data breaches, or further compromise of infrastructure that relies on the kernel.

How an attack unfolds

An attacker with local shell access creates an RDMA CM listening socket on a high port; the listener code frees a list element while it is still referenced; the attacker then reuses the freed memory to corrupt kernel structures and achieve privilege escalation or denial of service.

How to fix it

Upgrade the Linux kernel to the version containing commit bc0bdc5afaa74 or later from the torvalds/linux.git repository; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit bc0bdc5afaa74; review kernel source for the fixed RDMA CM listener path; test by attempting the high-port listener setup and verifying no use-after-free occurs.

Typical attack path

1. Obtain local user access on a Linux host
2. Create a socket and bind it as an RDMA CM listener on a high port
3. Trigger the race or reference pattern that frees the list element while still in use
4. Leverage the dangling pointer for memory corruption
5. Execute payload to escalate privileges or crash the system

How to detect it

Search kernel logs and dmesg for RDMA CM listener errors, list element use-after-free warnings, or related panics; review audit logs for unusual high-port socket creation by non-privileged users.

What your security team should do

• Apply the bc0bdc5afaa74 kernel fix to all systems using RDMA
• Limit local untrusted user access on production Linux hosts
• Monitor kernel logs for RDMA-related oops or use-after-free panics